Privacy Statement and Cookie Directive

As a controller within the context of the European General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act [“BDSG”, Bundesdatenschutzgesetz], DFL Deutsche Fußball Liga GmbH, Guiollettstrasse 44-46, D-60325 Frankfurt am Main (“DFL GmbH”) collects, processes and uses personal data which has been captured from visits to and use of the internet site b2b.bundesliga.com as well as its sub-domains (together, the “Bundesliga B2B Portal”) in compliance with the applicable data privacy provisions in the Federal Republic of Germany , in particular the GDPR and the BDSG. This Privacy Statement and Cookie Directive (hereinafter together: the "Statement") sets out which data of the users of the Bundesliga B2B Portal (“User”) is captured on the Bundesliga B2B Portal and how this information is processed.

1. Personal data

Personal data are all information which relate to an identified or identifiable natural person. A natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, for example, the name, personalized email addresses, the residential address, the telephone number or the date of birth.

2. Data collection, processing and use when accessing the Bundesliga B2B Portal

Each time a User accesses the Bundesliga B2B Portal, the User’s Internet browser, for technical reasons, automatically supplies the following data to DFL GmbH’s web server:

• IP address of the end device
• date and time of access
• name and URL of accessed page

• transferred data volume

• access status (data file transmitted, data file not found, etc.)
• recognition data of the used browser and operating system of the User's end device
• name of the User’s Internet service provider
• website from which the access was made

The collection, processing and use of these data occur for the purposes of enabling the use of the Bundesliga B2B Portal (connection set-up), system security and technical administration of the network infrastructure. A comparison with other data sets or a transmission to third parties, even in excerpts, does not take place.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) of the General Data Protection Regulation (“GDPR”)]. The legitimate interest of DFL results from the fact that DFL wants to provide a secure and functioning Bundesliga-B2B Portal.

With regard to data collection, processing, and use for the purpose of optimizing the Bundesliga B2B Portal through web analytics, additional reference is made to Section 6 of this Statement.

3. Data collection, processing and use in the context of the registration for and the login to the Bundesliga B2B Portal

The use of the Bundesliga B2B Portal requires a prior registration including entering personal data (name, company address, contact information, etc.). DFL GmbH uses the DFL Single Sign On („B2B SSO“) for the login to the Bundesliga B2B Portal. The B2B SSO is offered in joint control (Art. 26 GDPR) by DFL GmbH and DFL Deutsche Fußball Liga e.V. as well as Sportcast GmbH. The privacy statement of the B2B SSO which can be viewed here applies. The legal basis for processing is Art. 6 para. 1 sentence 1 b) GDPR.

4. Data collection, processing and use in the context of the use of the content of the Bundesliga-B2B Portal

Each time a User interacts with the content of the Bundesliga B2B Portal, the following data is collected and processed:

• User ID (unique ID)
• Item ID (unique ID for identification of the respective content)
• Timestamp (date and time of the interaction with the respective content)
• Event Type (type of interaction, e.g. start of the video preview, download)

The legal basis for processing is Art. 6 para. 1 sentence 1 b) GDPR if and to the extent the agreement on which the use of the Bundesliga B2B portal is based (e.g. (license) agreement with DFL Deutsche Fußball Liga e.V. or the GmbH) includes an obligation to use and distribute content made accessible via the Bundesliga B2B portal. Besides this, the legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR.  The legitimate interest for DFL GmbH results from the fact that DFL GmbH has an interest in ensuring the accessibility and distribution, the protection of rights and rights management and/or maintaining the confidentiality of the content made available via the Bundesliga B2B portal. Furthermore, DFL GmbH has an legitimate interest improving the content provided in the Bundesliga B2B portal, in particular in the optimization of the international product portfolio.

5. Data collection, processing and use in the context of the use of the content of the Content Recommendations

The data collected in accordance with Clause 4 will be used by DFL GmbH for the development and provision of a recommendation service. This recommendation services aims to suggest interesting editorial content to Users in the separate section “Content Recommendations”. Such suggestions are based on their use and interaction with the content of the Bundesliga B2B Portal.  

If the User does not want to see any recommended content, such recommendations can be deactivated by using the opt out feature available on his/her profile page . Such opt out is available upon the launch of the recommendation service. If the User opted out, no recommended content will be shown to him/her and the section “Content Recommendations” will be hidden.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest for DFL GmbH results from the fact that DFL GmbH has an interest in using and evaluating this data for purposes of the optimization of the content and services of the Bundesliga B2B Portal as well as in highlighting content that is of greatest interest to each User.

6. Data collection, processing and use in the context of web analysis with Matomo (formerly: Piwik)

In the Bundesliga B2B Portal, DFL GmbH uses the open source web analysis service “Matomo” (formerly: Piwik) provided by InnoCraft Ltd., New Zealand which is locally installed on the servers of DFL (“Matomo”). Matomo stores cookies on the User’s end device (more details about the used cookies can be found in Section 8 of this Statement) and the following data will be collected and stored by using Matomo:

• Two bytes of the IP address of the User’s accessing network
• Called up website
• Website from which the User has accessed the Bundesliga B2B Portal (referrer)
• Subpages accessed from the accessed website
• Duration of stay on the Bundesliga B2B Portal
• Frequency with which the Bundesliga B2B Portal is accessed

By using the feature „IP2Location™ IP-Country-Region-City-ISP Database [DB4]“ provided Hexasoft Development Sdn Bhd, Malaysia („ip2location“) additional geographic information (country, region, city) will be collected and stored based on the IP addresses in aggregated form. This feature is also locally installed on the servers of DFL GmbH.

A collection and storage always only takes place on the servers of DFL GmbH. The data will not be transmitted to Matomo or other third parties.

Matomo and ip2location are set in a way that the IP addresses are not stored completely, but 2 bytes of the IP address are masked (e.g.: 192.168.xxx.xxx). In this way, it is no longer possible to assign the shortened IP address to the calling computer. The User can prevent such an analysis by making use of the following opt-out. However, DFL GmbH hereby informs the User that in this case it is possible that the User cannot completely use all functions of the Bundesliga B2B Portal. In case the User opt-outs, another cookie will be stored on the User’s end device. This cookie will signal the system of DFL GmbH to not store the User’s data. If the User deletes cookies from his/her end device, this opt-out cookie will also be deleted and will have to be set again.

Further information about data protection are available under the following link.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest for DFL GmbH results from the fact that DFL GmbH has an interest in using and evaluating this data for purposes of the optimization of the Bundesliga B2B Portal.

7. Data collection, processing and use in the context of the monitoring of the compliance with the provisions of the terms of use of the Bundesliga B2B Portal and correction of errors

DFL GmbH reserves the right to protocol the use of the Bundesliga B2B Portal for the purpose of monitoring and compliance with the provisions in the terms of use of the Bundesliga B2B Portal as well as for any correction of errors. The connection data for the access to the Bundesliga B2B Portal will be protocolled for this purpose using information about the date/time, address of the user and used content and pages. In addition to use for the purposes of this Agreement, the protocols will be only used for the following purposes:

• analysis and correction of technical errors
• guaranteeing system security
• optimization for the user
• statistical determination of total use volume, and
• analysis in the course of monitoring misuse under Clause 11 of the terms of use of the Bundesliga B2B Portal.

DFL GmbH reserves the right to view samples of the protocols. Access to the protocols is limited to the data privacy officer of DFL GmbH and the persons entrusted with administration of the system.

The legal basis for processing is Art. 6 para. 1 sentence 1 f) GDPR. DFL GmbH has a legitimate interest in evaluating this protocol data for the purposes of the optimization and security of the Bundesliga B2B Portal.

8. Cookies

DFL GmbH uses different cookies on the Bundesliga B2B Portal. Cookies are small text files that are stored on the User’s end device and allow to recognize this end device. The Users have the option to adjust their browser's settings to prevent it from accepting the storage of cookies. Please note that in that case that certain parts of the Bundesliga B2B Portal may not work.

The following sections describes which categories of cookies are used on the Bundesliga B2B Portal and which cookies belong to each category:

8.1 Strictly necessary cookies

Strictly necessary cookies are necessary for the Bundesliga B2B Portal to function and cannot be switched off by the Users. The legal basis for the use of these cookies are the legitimate interests of DFL GmbH pursuant to Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of DFL GmbH results from the fact that DFL GmbH wants to ensure a secure and most efficient operation of the Bundesliga B2B Portal.

DFL uses the following strictly necessary cookie on the Bundesliga B2B Portal:

8.2 Performance cookies

Performance cookies enable DFL GmbH to analyse the use of the Bundesliga B2B Portal and to optimize the Bundesliga B2B Portal based on the User behaviour. DFL GmbH does not share information obtained from these cookies with third parties and does not use it for individual advertising.

The legal basis for the use of these cookies are the legitimate interests of DFL GmbH pursuant to Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of DFL GmbH results from the fact that DFL GmbH wants to analyse the use of the Bundesliga B2B Portal in order to make it as pleasant as possible for users.

DFL GmbH uses the following performance cookies on the Bundesliga B2B Portal:

8.3 Functional cookies

These cookies enable DFL GmbH to provide enhanced functionality and personalisation on the Bundesliga B2B Portal. These cookies can be set by DFL GmbH or its processors whose services DFL GmbH has added to the Bundesliga B2B Portal.  If the User does not allow these cookies, then some or all of these services may not function properly. The legal basis for the use of these cookies are the legitimate interests of DFL GmbH pursuant to Art. 6 para. 1 sentence 1 f) GDPR. The legitimate interest of DFL GmbH results from the fact that DFL GmbH wants to offer a Bundesliga B2B Portal with as many functions and interesting content as possible.

DFL uses the following performance cookies on the Bundesliga B2B Portal:

9. Limited purpose for processing and using personal data

All processing or use of personal data of the User occurs only for the purposes mentioned in this Statement and to the extent necessary to achieve the respective purpose.

Personal data are not published by DFL GmbH or disclosed to unauthorized third parties.

Transmissions of personal data to government agencies and public authorities occur only in accordance with mandatory national provisions in the law or if the disclosure is necessary in the case of attacks on the network infrastructure in order to pursue rights and for purposes of criminal prosecution. The legal basis for this processing is Art. 6 para. 1 sentence 1 c) GDPR in conjunction with § 24 para. 1 no. 1 b) German Data Protection Act [Bundesdatenschutzgesetz, "BDSG"].

10. Storage and deletion of personal data

All stored personal data and pseudonymized usage data are deleted immediately and permanently as soon as the data are no longer needed for the purposes for which they were collected or the User demands this unless DFL GmbH is required or entitled by law to do preserve the data. If DFL GmbH is required or entitled on the basis of provisions in the law to preserve the data, the stored personal data and pseudonymized usage data will be permanently deleted upon expiration of the time periods for preserving data required by law.

11. Security

DFL GmbH uses technical and organizational security measures in order to protect the personal data of the Users against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The security measures are continuously adapted in accordance with technological developments.

12. Links to other websites

The Bundesliga B2B Portal may contain links to other websites. This Statement applies solely to the Bundesliga B2B Portal. DFL GmbH has no influence over, and does not control whether other providers comply with applicable data privacy provisions.

13. Rights of the User

The User has several rights under the GDPR. In particular, the User has

• a right to information with regard to the stored personal data of the User (Art. 15 GDPR);
• a right to have incorrect data corrected (Art. 16 GDPR);
• a right to erasure under the prerequisites described in Art. 17 GDPR;
• a right to restriction of the processing (Art. 18 GDPR);
• a right for data transferability (Art. 20 GDPR); and
• a right to object against the processing, if such processing safeguards Our legitimate interests (Art. 21 GDPR).

DFL GmbH points out that DFL GmbH reserves the right to suspend the User's access to the Bundesliga B2B portal while his/her request is being processed when exercising the right of objection under Art. 21 GDPR. DFL GmbH will immediately notify the User of such a measure.

The User can assert his/her rights by emailing registration@bundesliga.de or by posting a letter to the registered office of DFL GmbH. The data privacy officer of DFL GmbH can be contacted at dataprivacy@dfl.de. Please note that only data privacy-related messages will be answered at this email address.

Furthermore, the User can submit a complaint about the data processing to the responsible supervisory authority. The Hessian Commissioner for Data Protection and Freedom of Information [Hessischer Beauftragter für Datenschutz und Informationsfreiheit] is responsible for DFL and the User can submit a complaint via the following link.

14. Where can the User find the relevant legal texts?

The GDPR can be found under the following link, the BDSG and other relevant German legal texts under the following link.

15. Applicability, validity and timeliness of the Statement

The provisions in this Statement on collection, processing and use of the User’s data apply for the User when using the Bundesliga B2B Portal. This Statement is current valid and is dated as of 15 February 2021. DFL GmbH reserves the right to amend this Statement at any time as needed with effect for the future, especially for the purposes of adaption to a further development of the Bundesliga B2B Portal or the implementation of new technologies.